|
Is there a quick way to retrieve the list of all unique values of an indexed field? I know I could search for the field and pipe to uniq, but hoping there might be something faster. |
|
Absolutely. There's several ways to do this. Lets assume your field is called 'foo'. The most straightforward way is to use the
Using stats opens up the door to collect other statistics by those unique values. For example:
which will take the average of a field called http://www.splunk.com/base/Documentation/latest/SearchReference/Stats Another way worth mentioning is to just use
For
(31 May '10, 13:30)
gkanapathy ♦
|
|
Actually, we were hoping that, because it is an indexed field, there is some kind of metadata or list that is persisted that we could access quickly, without running a search over all our events. I guess the simplest case would be source, sourcetype, or host - is there any quick way to find the list of all indexed hosts without going through stats or some other search? It seems like there must be, because the summary view displays those. We'd like to pull that type of summary information for any indexed field to get a list of all possible field values. can you add this as a comment to Nick's answer, and not as a new answer?
(14 May '10, 19:30)
piebob ♦♦
For some reason, I don't see an "add comment" field on Nick's answer. Is there some other way to do that?
(18 May '10, 15:28)
esachs ♦
For
(31 May '10, 13:27)
gkanapathy ♦
|